Home | History | Annotate | Line # | Download | only in pam_skey 
      1 /*	$NetBSD: pam_skey.c,v 1.3 2008/04/28 20:23:01 martin Exp $	*/
      2 
      3 /*-
      4  * Copyright (c) 2005 The NetBSD Foundation, Inc.
      5  * All rights reserved.
      6  *
      7  * This code is derived from software contributed to The NetBSD Foundation
      8  * by Jason R. Thorpe.
      9  *
     10  * Redistribution and use in source and binary forms, with or without
     11  * modification, are permitted provided that the following conditions
     12  * are met:
     13  * 1. Redistributions of source code must retain the above copyright
     14  *    notice, this list of conditions and the following disclaimer.
     15  * 2. Redistributions in binary form must reproduce the above copyright
     16  *    notice, this list of conditions and the following disclaimer in the
     17  *    documentation and/or other materials provided with the distribution.
     18  *
     19  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
     20  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     21  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     22  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
     23  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     24  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     25  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     26  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     27  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     28  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     29  * POSSIBILITY OF SUCH DAMAGE.
     30  */
     31 
     32 #include <sys/cdefs.h>
     33 __RCSID("$NetBSD: pam_skey.c,v 1.3 2008/04/28 20:23:01 martin Exp $");
     34 
     35 #include <sys/types.h>
     36 #include <string.h>
     37 #include <stdio.h>
     38 #include <stdlib.h>
     39 #include <unistd.h>
     40 
     41 #include <skey.h>
     42 
     43 #define	PAM_SM_AUTH
     44 
     45 #include <security/pam_appl.h>
     46 #include <security/pam_modules.h>
     47 #include <security/pam_mod_misc.h>
     48 
     49 /*
     50  * authentication management
     51  */
     52 PAM_EXTERN int
     53 /*ARGSUSED*/
     54 pam_sm_authenticate(pam_handle_t *pamh, int flags __unused,
     55     int argc __unused, const char *argv[] __unused)
     56 {
     57 	const char *user, *skinfo, *pass;
     58 	char *response;
     59 	int retval;
     60 	char skprompt[80];
     61 
     62 	if (openpam_get_option(pamh, PAM_OPT_AUTH_AS_SELF)) {
     63 		user = getlogin();
     64 	} else {
     65 		retval = pam_get_user(pamh, &user, NULL);
     66 		if (retval != PAM_SUCCESS)
     67 			return (retval);
     68 		PAM_LOG("Got user: %s", user);
     69 	}
     70 
     71 	if (skey_haskey(user) != 0)
     72 		return (PAM_SERVICE_ERR);	/* XXX PAM_AUTHINFO_UNAVAIL? */
     73 
     74 	skinfo = skey_keyinfo(user);
     75 	if (skinfo == NULL) {
     76 		PAM_VERBOSE_ERROR("Error getting S/Key challenge");
     77 		return (PAM_SERVICE_ERR);
     78 	}
     79 
     80 	(void) snprintf(skprompt, sizeof(skprompt),
     81 	    "Password [ %s ]:", skinfo);
     82 
     83 	retval = pam_get_authtok(pamh, PAM_AUTHTOK, &pass, skprompt);
     84 	if (retval != PAM_SUCCESS)
     85 		return (retval);
     86 
     87 	response = strdup(pass);
     88 	if (response == NULL) {
     89 		pam_error(pamh, "Unable to copy S/Key response");
     90 		return (PAM_SERVICE_ERR);
     91 	}
     92 
     93 	retval = skey_passcheck(user, response) == -1 ?
     94 	    PAM_AUTH_ERR : PAM_SUCCESS;
     95 
     96 	free(response);
     97 
     98 	return (retval);
     99 }
    100 
    101 PAM_EXTERN int
    102 /*ARGSUSED*/
    103 pam_sm_setcred(pam_handle_t *pamh __unused, int flags __unused,
    104     int argc __unused, const char *argv[] __unused)
    105 {
    106 
    107 	return (PAM_SUCCESS);
    108 }
    109 
    110 PAM_MODULE_ENTRY("pam_skey");
    111